A single, short Reddit comment as brief as 13 words is sufficient to corrupt the reports generated by modern AI deep-research agents, steering them to cite fictitious products and fraudulent services as legitimate recommendations.
Deep-research agents are AI systems that go far beyond a traditional search engine by autonomously issuing dozens of related queries, retrieving and synthesizing web content, and producing structured, cited reports.
As documented on Arxiv, systems like STORM, Co-STORM, and OmniThink represent this emerging class, and their capabilities are increasingly mirrored in commercial products such as OpenAI Deep Research and Gemini Deep Research.
Reddit Comment Can Poison ChatGPT and Gemini Search Results
Because they retrieve information directly from the open web and incorporate it into synthesized answers, the documents they access become natural targets for manipulation.
WARP Attack stages
The attack, dubbed WARP (Web Agent Retrieval Poisoning), exploits a structural weakness in how these agents gather information. The attack proceeds in three stages:
- Reconnaissance: The attacker queries a public search engine to identify which user-generated content (UGC) pages, primarily Reddit threads, consistently appear across multiple related search queries on a given topic.
- Content generation: The attacker crafts a short poisoned passage, as few as 13 words, promoting a fictitious entity (a fake product, service, or brand), using Generative Engine Optimization (GEO) techniques to maximize citation likelihood.
- Deployment: The attacker posts the text as a Reddit comment or Wikipedia edit; no special access or technical privileges are required.
Once indexed by a search engine, the poisoned content becomes part of what agents retrieve and synthesize into their final reports.
Across all three open-source agent systems evaluated, Reddit dominated the UGC URLs retrieved, accounting for 54–71% of all UGC URLs.
Search engines favor Reddit’s community-driven, first-person discussion threads for advice-seeking queries, precisely the kinds of queries deep-research agents are most commonly used for.
Critically, the same Reddit URLs appeared repeatedly across many related queries within a single topic cluster, creating what the paper describes as a “concentrated attack surface”. The experiments, run across 176 queries spanning 11 topic clusters, revealed alarming attack success rates.
In the SERP-snippet setting where the 13-word poisoned text is appended to the short search result snippet, Co-STORM achieved a 100% conditional citation rate, meaning every time the poisoned URL was retrieved, it was cited in the final report.
Even with a single poisoned URL, Co-STORM mentioned the attacker’s target entity in 30.7% of runs, while STORM did so in 37.1%.
The impact was demonstrated in concrete examples: a fake cryptocurrency called “BananaCoin” was presented alongside real assets like Bitcoin and Ethereum in an investment report, while a nonexistent roadside assistance company was recommended as a legitimate AAA alternative, all triggered by a single injected comment.
Three lines of defense were tested, and none proved fully effective without meaningful trade-offs:
- Source-level blocking (removing all UGC domains) eliminated the attack surface but degraded output quality by stripping valuable community expertise.
- Input filtering via LLM screening was prohibitively expensive, adding up to 61 additional inference calls per query.
- Perplexity-based detection backfired — GEO-optimized poisoned text was actually more fluent than organic UGC, meaning standard filters discarded legitimate content while retaining malicious text.
- Output-level detection also failed: poisoned reports were statistically more similar to clean reports than clean reports were to each other, making manipulation nearly undetectable.
Arxiv stated that the vulnerability is structural rather than incidental. Deep-research agents face a fundamental trade-off: leveraging community-generated content enriches their reports but simultaneously opens a direct path for manipulation.
With the barrier to posting a Reddit comment being near zero, adversaries ranging from scammers and fraudsters to state-backed disinformation operations could inject false product recommendations, fake emergency service numbers, or propaganda into AI-generated research consumed by millions.
The simulation framework and dataset behind this research have been released publicly to accelerate the development of more robust defenses, an urgent priority as agentic AI search continues to replace traditional web browsing.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
